Process injection (T1055) means executing arbitrary code in the address space of a separate live process. MITRE files it under Stealth and Privilege Escalation, and it applies on Linux, macOS and Windows.
The appeal is straightforward. Code that runs inside another process borrows that process's identity. It may reach the process's memory, system and network resources, and possibly elevated privileges. Security products that judge by process name or parent may see only a trusted program doing what it normally does.
How attackers use it
MITRE notes that there are many ways to inject code, and many abuse legitimate functionality. Implementations exist for every major operating system, but they are typically platform specific. More sophisticated samples may inject more than once to split their modules apart, using named pipes or other inter process communication as a channel between the pieces.
The technique has twelve sub-techniques on the MITRE page, among them DLL injection, PE injection, thread execution hijacking, asynchronous procedure calls, thread local storage, ptrace system calls, proc memory, extra window memory injection, process hollowing, process doppelganging, VDSO hijacking and ListPlanting. Each is a different route to the same outcome.
Observed targets on the MITRE page include common system and browser processes. That makes sense: a process that is expected to be running, and expected to talk to the network, is a good place to hide.
How to detect it
MITRE's detection strategy has one analytic per operating system.
- Windows: correlate memory manipulation API calls such as VirtualAllocEx and WriteProcessMemory, suspicious thread creation such as CreateRemoteThread, and unusual DLL loads within another process's context.
- Linux: look for ptrace or memfd based injection in audit logs, capturing system calls such as ptrace and mmap that target running processes, along with suspicious file descriptors or memory writes.
- macOS: monitor task_for_pid, mach_vm_write and dylib injection patterns, including DYLD_INSERT_LIBRARIES and manual memory mapping.
As with most behavioral detection, no single event convicts. A process opening another process is routine. The chain is what matters: a handle opened with write rights, memory allocated and written in the target, then execution started there.
Practical telemetry to collect:
- Windows Sysmon event ID 8 (CreateRemoteThread), event ID 10 (ProcessAccess) and event ID 7 (image loaded).
- Linux auditd rules covering the ptrace system call.
- Process ancestry and module lists, so a browser or system process loading an unexpected module stands out.
- Network connections from processes that normally make none.
Baseline first. Know which tools legitimately inject, such as debuggers and some security and accessibility software, so you can exclude them and keep the signal clean.
How to reduce the risk
MITRE lists two mitigations.
- Behavior prevention on endpoint. Some endpoint security tools can be configured to block certain types of injection based on common sequences of behavior. On Windows 10, MITRE gives the example of Attack Surface Reduction rules preventing Office applications from code injection.
- Privileged account management. On Linux, use Yama to restrict ptrace to privileged users through
/proc/sys/kernel/yama/ptrace_scope. Other controls include security kernel modules that provide access control and process restrictions, such as SELinux, grsecurity and AppArmor.
Both point at the same idea: reduce which processes are allowed to touch each other, and block the known sequences.
Check your own environment
Read-only checks:
- Linux shell:
cat /proc/sys/kernel/yama/ptrace_scopeshows the current Yama setting. Higher values are more restrictive, and 0 means classic permissive ptrace. - Linux shell:
sudo auditctl -llists active audit rules, so you can confirm whether ptrace is covered. - Windows PowerShell:
Get-MpPreference | Select-Object AttackSurfaceReductionRules_Ids, AttackSurfaceReductionRules_Actionslists configured ASR rules and their modes. - Windows: confirm your Sysmon configuration records event IDs 7, 8 and 10.
Then ask three questions of your own estate. Do endpoint tools see memory writes between processes? Can you tell a debugger from an injector in your logs? Is ptrace restricted on servers that have no need for debugging?
Injection is often the final step after something got onto the machine in the first place, and package and dependency trust is one of the ways code arrives. The free scan at gold.safeguard.sh/scan checks up to 100 dependencies in your browser with no login, and your file never leaves your machine.
Quick check
Why does injected code evade many process based defenses?
It runs under the identity of a legitimate process, so name based and parent based checks see a trusted program.
What Linux setting does MITRE suggest to limit ptrace based injection?
Yama, through the ptrace_scope setting, restricting ptrace to privileged users. SELinux, grsecurity and AppArmor add further process restrictions.
Which Windows calls form a common injection chain?
Opening the target, allocating and writing memory with VirtualAllocEx and WriteProcessMemory, then starting a thread such as with CreateRemoteThread.
Sources
- MITRE ATT&CK: Process Injection (T1055)
